diff --git a/.github/workflows/app-build.yml b/.github/workflows/app-build.yml
index e97190fbb..13665dd07 100644
--- a/.github/workflows/app-build.yml
+++ b/.github/workflows/app-build.yml
@@ -191,7 +191,10 @@ jobs:
           apksigner=$(ls "$ANDROID_HOME"/build-tools/*/apksigner | sort -V | tail -1)
           "$apksigner" verify "$apk"
           if [ "$MODE" = release ]; then
-            actual=$("$apksigner" verify --print-certs "$apk" | sed -n 's/^Signer #1 certificate SHA-256 digest: //p' | head -1)
+            # 新版 apksigner 的行首可能是 "Signer #1" 或 "Signer (minSdkVersion=…)"，只按字段名匹配
+            certs=$("$apksigner" verify --print-certs "$apk")
+            echo "$certs" | grep -i 'certificate SHA-256 digest' || true
+            actual=$(echo "$certs" | grep -i -m1 'certificate SHA-256 digest:' | sed 's/.*: *//' | tr -d ': ' | tr 'A-F' 'a-f')
             expected=$(echo "$ANDROID_CERT_SHA256" | tr -d ':' | tr 'A-F' 'a-f')
             if [ "$actual" != "$expected" ]; then
               echo "::error::APK 签名证书与正式包不一致（$actual），无法覆盖升级"